CVE-2025-2842: Tempo-operator: tempo operator token exposition lead to read sensitive data

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-02 · updated 2026-09-08
Weakness: CWE-200

Description

A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.

Affected products

Red Hat OpenShift distributed tracing 3: all versions
Red Hat OpenShift distributed tracing 3.5.3: all versions — fixed in rhosdt-3.5-1743162265, rhosdt-3.5-1744028971

How to fix

Upgrade to a fixed version: Red Hat OpenShift distributed tracing 3.5.3 rhosdt-3.5-1743162265, rhosdt-3.5-1744028971. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-2842 or the next vulnerability affects your stack